School Procurement Review Pack
Everything procurement needs to review ReviseWell
When a Head of Department wants to bring ReviseWell into a school, the DPO, SLT or procurement team asks a predictable set of questions: what is it, what data does it touch, where does that data go, is it safe, and how do we pay. This document starts that review in one place. Before a school-data pilot starts, ReviseWell supplies the final DPA and confirms the deployment-specific hosting details. Section 1 is the 60-second summary; 2–8 are the detail; 9 is the paperwork.
1. The 60-second summary (for the DPO / bursar)
| What is ReviseWell? | An online platform that sets exam-style questions, marks students' written answers with AI against the official mark scheme, and gives teachers a diagnosis of what each class and student needs next. |
| Who provides it? | REVISEWELL LIMITED, registered in England & Wales (no. 16765299), registered office 50 Cassandra Court, Asgard Drive, Salford, M5 4TW. |
| What personal data does it process? | Student first/last name, class/group, the answers students submit, and their marks/progress. Teacher name + email for logins. The service does not request date of birth, home address or special-category data. |
| Does student data go to an AI provider? | Yes. Answer text (and, for handwriting, the photo) goes to AI models from OpenAI and Anthropic, reached through OpenRouter. The full list is in §3. |
| Where is data stored? | In a MySQL database, a MongoDB database, and log files on our application server. See §4. |
| How long is it kept? | Some records delete themselves on a timer. Others have no automatic deletion yet. §4 lists each one. |
| Is there a DPA? | A UK GDPR Article 28 Data Processing Agreement is available on request (currently in final legal review). See §9.1. |
| Children's data? | Yes. The school remains the data controller; ReviseWell is the processor. Children's data is never sold or used for advertising. Optional product analytics are described in §4 and §6. |
| How do we pay? | Annual licence by invoice (PO-friendly) or monthly card. Free 30-day pilot first, no card required. Pricing in §9.2. |
2. Company & contact
- Legal entity: REVISEWELL LIMITED
- Company number: 16765299 (England & Wales)
- Registered office: 50 Cassandra Court, Asgard Drive, Salford, England, M5 4TW
- Data-protection enquiries: via your pilot lead, or contact@revisewell.net
- Contact for your DSL or data lead: email contact@revisewell.net with any question about this pack.
- Governing law: England & Wales
3. How the AI marking works (plain English)
A student opens an exam-style question and types their answer. On submit, ReviseWell sends three things to an AI language model: the question, the student's answer text, and the official mark scheme. The model returns a mark and point-by-point feedback against the scheme. The student sees the feedback; the teacher sees it aggregated across the class.
What the AI does not receive: no student name, email, school or account identifier. The link back to “which student” is added after the AI call, inside ReviseWell's own database, so the provider cannot identify the child from the data sent. (The answer text is sent as written, so the school should instruct students not to type identifying or special-category data into answer boxes — see §5.)
Is the marking reliable? It is strong but not infallible, and we say so plainly. Every Class Report includes a “spot-check the AI” appendix — real answers shown with the question, the mark scheme and the AI's reasoning, so a teacher can verify the marking without leaving the document — and any teacher can flag a wrong mark with a Report Question button. ReviseWell is positioned as a diagnosis the teacher doesn't have time to produce manually, not a replacement for professional judgement.
Which AI models see student text? Every AI call from the ReviseWell app goes through OpenRouter, a service that passes the request to the model provider.
| What | What is sent | Model |
|---|---|---|
| Marking typed answers | Question, answer text, mark scheme | OpenAI GPT-4o and GPT-4o mini |
| Handwritten answers | The photo the student takes | OpenAI GPT-4o reads the handwriting |
| English Literature essays | Question and essay | OpenAI GPT-4o |
| Re-checks of a wrong answer | Question, answer, mark scheme | Anthropic Claude Haiku 4.5 or Claude Opus 4.5 |
| Model answers built from a student's answer | Question and answer | Anthropic Claude Opus 4.5 |
| Class misconception summaries for teachers | Student answers and marking feedback from the class | OpenAI GPT-4o and GPT-4o mini |
| Revi, the teacher assistant | What the teacher types and the files they add | Anthropic Claude Haiku 4.5, with DeepSeek as a backup |
| Concern flag (only if the school turns it on, §5) | A short piece of student text that matched a worrying phrase | Anthropic Claude Haiku 4.5 |
A photo of handwriting is sent as taken. If a student writes their name on the page, the model sees it. Ask students to photograph only the answer.
4. Student data: what we store, where, and for how long
| What | Where | How long |
|---|---|---|
| Account: name, class, school, login | MySQL database | No automatic deletion. A removed account is switched off and can no longer log in, but the record stays. |
| Marked answers, marks and feedback | Log files on our application server, plus score records in MySQL | Log files: a cleanup script deletes files older than 540 days. Score records: no automatic deletion. |
| Answer drafts (what a student types before submitting) | Log files on our application server | No automatic deletion. |
| Activity log: what students type and do in the app | MongoDB database | Deleted automatically after 365 days. Emails, phone numbers and social handles are removed before saving. |
| Questions students send their teacher | MongoDB database | No automatic deletion. |
| Live quiz names, answers and results | MongoDB database | No automatic deletion. |
| Live quiz drawings (Show Me boards) | MongoDB database | Deleted automatically 6 hours after the last update. |
| Handwriting photos | Not stored. Only the text read from the photo is kept. | As for marked answers. |
| Concern flags (only if turned on, §5) | MongoDB database | No automatic deletion. |
Export and deletion: there is no self-serve delete button. The school emails contact@revisewell.net. We export and/or delete that student's data, or the whole school's, from the stores above within one month, and confirm in writing. Full deletion is the default. The school can choose anonymising instead (the name becomes "Deleted student", typed text is wiped, marks are kept for class totals).
Before we delete, we save an export of the data in a private folder on our server. That saved copy is deleted after 30 days. Log files still being written that week are cleared the following week. Concern flags are sent to the school's safeguarding lead before they are deleted. Teacher logins are kept unless the school asks us to remove them.
5. Safeguarding & privacy (children's data)
- The school is the data controller; ReviseWell is the processor, acting only on the school's documented instructions.
- No advertising use of children's data. Children's answers and results are used to mark work and produce educational analytics for teachers — never sold or used for advertising. Optional product analytics are described in §4 and §6.
- No special-category data requested. The service does not ask for it; the school should instruct students not to enter it (or unnecessary identifiers) in free-text answers, which are sent to the AI marker as written.
- Student-to-student isolation. Students see only their own attempts; only teachers/HoDs see the cohort view. Scoping is enforced server-side.
- Minimal identifiers. Only first/last name + class are collected — no DOB, home address or parental contact details.
- Lawful basis. The school determines the lawful basis for processing children's data; ReviseWell supports the school's privacy notice with the facts in this pack.
Concern flag (off unless your school asks for it). When it is on, worrying things a student writes inside ReviseWell, such as words about self-harm, abuse or running away, are checked by a phrase filter and then an AI model. A match goes to a private page that only your named safeguarding lead can open. Students see nothing different. It does not see anything outside ReviseWell. It can miss things. Keep using your school's safeguarding process.
6. Data-processing schedule
The AI models that see student text are listed in §3 and the stores in §4. Hosting regions and international-transfer details are supplied privately during procurement review and documented in the final DPA before a school-data pilot starts.
7. Security summary
- In transit: all connections use HTTPS/TLS.
- Authentication: authenticated teacher/HoD routes use JWT validation; sensitive server routes enforce tenant or roster scoping.
- Access control: production-data access is restricted to authorised personnel on a least-privilege basis with individual credentials.
- Secrets: runtime access credentials are held as server environment variables. Credential-rotation status is confirmed in the security questionnaire before pilot start.
- Breach response: the notification commitment is documented in the final DPA supplied before pilot start. The current draft targets notification without undue delay and within 48 hours of becoming aware of a breach affecting school data.
- Data minimisation: no DOB/address collected; the AI marker receives no identifiers (§3).
A full security questionnaire (SIG-lite or your own vendor-assessment form) and a data-flow diagram can be completed on request.
8. Procurement FAQ
Is there lock-in? No. A licence is a 12-month term with no auto-renewal and no card on file — it simply ends unless you renew. We give 60 days' notice before expiry. Deletion / return terms are set out in the final DPA.
Do you need a DPA signed before the pilot? Schools receive the final Article 28 DPA for review before any school-data pilot starts. It covers the pilot and paid service identically.
Where does our money go vs our data? Different places. Payment processing is separate from the student-data flow; student data never touches the payment rail.
What happens to a child's data if they leave? Their account can be switched off so it no longer logs in. If the school asks, we export and/or delete their data within one month and confirm in writing (§4).
9. Paperwork
9.1 Data Processing Agreement (UK GDPR Article 28)
A UK GDPR Article 28 DPA is available on request (currently in final legal review). It is a standard controller–processor contract covering documented instructions, confidentiality, security, provider schedules, data-subject rights, breach notification, international transfers, audit, and return/deletion. It is attached as a separate signable document on request.
9.2 Pricing
| Tier | Students | Price |
|---|---|---|
| Free Pilot | ≤ 80 | £0 for 30 days |
| Small Department | ≤ 150 | £995 / year |
| Department | ≤ 250 | £1,495 / year |
| Whole School | ≤ 500 | £2,495 / year |
| International / MAT | custom | from £5,000 / year |
No auto-renewal. 60 days' notice before any renewal. Free 30-day pilot first, no card required.
9.3 Purchase-order / invoice wording
Supplier: REVISEWELL LIMITED
Company no.: 16765299
Registered: 50 Cassandra Court, Asgard Drive, Salford, M5 4TW
Description: ReviseWell annual licence — [Tier] (up to [N] students)
[Subject(s)], academic year [YYYY/YY]
Period: [start] to [end] (annual, no auto-renewal)
Amount: £[amount]
Payment terms: 30 days from invoice date
PO number: [school PO number]